Systems and methods for determining access outcomes using access request scoring

ABSTRACT

Resources can be secured by a resource security system. The resource security system can determine whether to grant or deny access to resources using authorization information in an access request. The resource security system can also determine whether the access request is legitimate or fraudulent using risk scoring models. A score transformation table can be used to provide consistency in the risk level for a particular score over time. The score transformation table can be based on a target score profile and a precision format (e.g., integer or floating point). The score transformation table can dynamically adapt based on the trending top percent of risk and can account for changes in the distribution of scores over time or by weekday. The scores can be used to determine an access request outcome. Access to the resource can be accepted or rejected based on the outcome.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation application to U.S. application Ser.No. 17/083,086, filed Oct. 28, 2020, entitled “SYSTEMS AND METHODS FORDETERMINING ACCESS OUTCOMES USING ACCESS REQUEST SCORING” which is acontinuation of U.S. application Ser. No. 16/160,943 filed Oct. 15,2018, entitled “SYSTEMS AND METHODS FOR DETERMINING ACCESS OUTCOMESUSING ACCESS REQUEST SCORING” which is related to U.S. application Ser.No. 16/160,936, entitled “SYSTEMS AND METHODS FOR DETERMINING ACCESSREQUEST SCORING FOR ACCESS OUTCOMES,” filed on Oct. 15, 2018, the entirecontents of which are hereby incorporated by reference for all purposes.

BACKGROUND

Unauthorized users may fraudulently obtain access to a digital orphysical resource using stolen account names and authenticationinformation. To prevent unauthorized access, a resource provider may usea risk scoring model to identify access requests having risk scoresindicative of fraud. Based on the risk score, a request to access aresource may be rejected even if proper account and authenticationinformation is provided.

However, unauthorized users may change their methods and behavior formaking fraudulent resource access requests over time. Such changes inmethod and behavior may impact the features and parameters of the accessrequest that are relevant to the scoring model. In addition, authorizedusers may also change their methods and behaviors for making legitimateresource access requests. While the scoring model can be periodicallyupdated, the changing patterns of behavior can cause inconsistency inscoring over time. Accordingly, there is a need for improved systems andmethods for securing access to resources.

BRIEF SUMMARY

Some embodiments provide a method for processing access requests. Themethod can be performed by a computer system. The method includesdetermining raw scores for a plurality of previous access requests usinga scoring model. Each of the raw scores can be within a set of potentialoutput values of the scoring model. For example, the set of potentialoutput values (e.g., potential scores) for the scoring model can beintegers from 0 to 100,000. That is, the values can be stored asintegers. The method can further include determining, for each potentialoutput value of the set of potential output values, a percentage of theraw scores that equal the potential output value. The method can furtherinclude determining a trending top percent table including a trendingtop percent value for each potential output value. The trending toppercent value for a particular potential output value can be based onthe percentages of the raw scores that are equal to or greater than thepotential output value. For example, a score of 90,000 can be in the top10% of the raw scores for the plurality of previous access requests.

The method can further include determining a first distribution functionusing a first predetermined top percent value for a first abbreviatedscore. The first distribution function can map each abbreviated score ina set of abbreviated scores to a target population percentage for theabbreviated score where the set of abbreviated scores includes the firstabbreviated score. The method can further include determining a scoringprofile table including a target top percent value for each abbreviatedscore in the set of abbreviated scores based on the first distributionfunction. For example, the set of abbreviated scores can be integersfrom 0 to 99.

The method can further include determining a score transformation tableby determining, for each abbreviated score in the set of abbreviatedscores, a corresponding potential output value. The correspondingpotential output value can be determined based on its trending toppercent value being closer to the target top percent value for theabbreviated score compared to the trending top percent values for otherpotential output values. The score transformation table can be used todetermine a first abbreviated score based on a first raw score for afirst access request that is determined using the scoring model. Thefirst abbreviated score can indicate an access request outcome for thefirst access request. The outcome can be based on a threshold. Forexample, an abbreviated score of 10 can indicate that the access requestshould be accepted while an abbreviated score of 90 can indicate thatthe access request should be denied.

These and other embodiments of the disclosure are described in detailbelow. For example, other embodiments are directed to systems, devices,and computer readable media associated with methods described herein.

Further details can be found in the detailed description and thefigures.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a resource security system for providing access toresources, in accordance with some embodiments.

FIG. 2 shows an information flow diagram of a process for building ascore transformation table, in accordance with some embodiments.

FIG. 3 shows a graphical user interface for creating a target scoringprofile, in accordance with some embodiments.

FIG. 4 shows graphs illustrating non-smooth score distributions.

FIG. 5 shows graphs illustrating changes in risk level per score overtime.

FIG. 6 shows graphs illustrating risk level oscillation by day of week.

FIG. 7 shows graphs of a target scoring profile based on distributionfunctions and conjugate functions, in accordance with some embodiments.

FIG. 8 shows graphs illustrating filtering the top percent risk valuesfor a score, in accordance with some embodiments.

FIG. 9 shows a flowchart of a method for processing access requests, inaccordance with some embodiments.

FIG. 10 shows a process for using a score transformation table todetermine an abbreviated score for an access request, in accordance withsome embodiments.

FIG. 11 shows a method for processing an access request, in accordancewith some embodiments.

DETAILED DESCRIPTION

A resource security system may be used to grant or deny access toresources. The resource security system can include an access serverimplementing a scoring model that provides risk scores. The risk scorescan be used by a resource provider computer or a request computer toreject access requests having risk scores indicative of fraud. In someembodiments, higher scores can indicate a higher risk level (e.g., theaccess request is more likely to be fraudulent) while lower risk scorescan indicate a lower risk level (e.g., the access request is more likelyto be legitimate). If fraudulent access does occur, it may be reportedand stored as validity information associated with the correspondingfraudulent access request. This validity information along with the mostrecent access request data can be used to periodically update thescoring model.

One problem that may arise in resource security systems is that the risklevel associated with a particular risk score may change over time. Thismay occur as resource request behaviors change over time or when thescoring model is updated. The risk level for a score can be based on thedistribution of scores over the population. For example, if 10% of thescores for a sampled population are between 50,000 and 100,000, then thescore of 50,000 has a top percent risk level of 10%. That is, an accessrequest scoring 50,000 is within the top 10% of the most risky accessrequests, as scored by the model.

However, the top percent risk of a particular score can change asbehaviors for making access requests change. For example, the score of50,000 may have a top percent risk of 10% in one month but have a toppercent risk of 6% in the following month. This change in risk level canoccur because the risk level is based on the distribution of scoresacross the sampled population and the distribution is changing. Thedistribution of scores can also change when the model is updated sincethe features and weighting used by the model may be different comparedto the old model. Thus, the meaning of the scores has changed over time.For instance, a score of 50,000 is more risky when it is within the top6% of the population compared to when it is within the top 10% of thepopulation.

The changing distribution of scores and the resulting change in the risklevel of those scores (e.g., the percent of the population that thescore corresponds to) is problematic because resources providers andresource requesters may rely on predetermined score thresholds to acceptor reject access requests. For instance, a resource provider maydetermine through investigation that 6% of all access requests arefraudulent. Accordingly, the resource provider may select a scoringthreshold to reject the top 6% most risky access requests. However, thedistribution of scores can change over time, or when the scoring modelis updated, as mentioned above. Therefore, the predetermined scoringthreshold may no longer correspond to the top 6% most risky accessrequests. Instead, the predetermined scoring threshold may nowcorrespond to the top 10% most risky access requests, instead of 6% asoriginally intended. Thus, the predetermined scoring threshold can nowcause 10% of access requests to be rejected, instead of only 6%. This isproblematic because authorized users legitimately attempting to accessresources can be rejected more often. In another situation, where thepercentage of the population that the scoring threshold corresponds todecreases over time (e.g., from 6% to 3%), then more fraudulent accessrequests are being accepted, causing harm to legitimate users. Thus,there is a need for scoring systems and methods that provide consistentscoring over time (e.g., the distribution of scores is consistent).

Embodiments of the invention generate a score transformation table thatdynamically adapts to changes in the distribution of scores such thatthat scores consistently correspond to certain risk levels. Thus, thescore transformation table overcomes the problems discussed above. Togenerate the score transformation table, a scoring profile table isdefined to set certain scores to correspond to certain percentages of apopulation of access requests, and thus, certain risk levels. The set ofscores defined in the scoring profile table can be abbreviated comparedto the set of potential scores output by the scoring model. For example,the scoring profile table may use abbreviated scores of 0 through 99while the scores output by the scoring model may have potential outputvalues between 0 and 100,000. The scores output by the scoring model maybe referred to as raw scores.

The score transformation table can dynamically associate raw scores withthe abbreviated scores defined by the scoring profile table based on thecurrent risk level of the raw score compared to the defined risk levelof the abbreviated score. To do this, the distribution of scores istracked and the risk levels are periodically computed. The defined risklevel for an abbreviated score set by the scoring profile can be matchedto the closest trending (e.g., current) risk level for a raw score, andthese scores can be associated in the update score transformation table.In some embodiments, the trending distribution of scores andcorresponding risk levels can be computed by day of week to account forthe different patterns and behaviors that occur on different days. Thus,the score transformation table indicates which raw score output by thescoring model corresponds to a particular abbreviated score. Since thescore transformation table accounts for the trending risk level of theraw scores, the risk levels of the abbreviated scores is consistent overtime, thereby solving the scoring problems discussed above.

Systems and methods for creating and using the score transformationtable are further discussed below with respect to the figures.

I. Terms

Prior to discussing embodiments of the invention, description of someterms may be helpful in understanding embodiments of the invention.

The term “resource” generally refers to any asset that may be used orconsumed. For example, the resource may be an electronic resource (e.g.,stored data, received data, a computer account, a network-based account,an email inbox), a physical resource (e.g., a tangible object, abuilding, a safe, or a physical location), or other information.

A “resource provider” can include an entity that provides resources foruse by users and/or user devices. Examples of resource providers includebuilding or site managers, e-mail service providers, digital storageproviders, social media account providers, other website accountproviders, etc. A resource provider may use an “access server” toauthenticate access requests. The access server may store registeredauthentication information and a scoring model, which can be used indetermining whether to grant or deny access to the resources.

The term “access request” generally refers to a request to access aresource. The access request may be received from a requesting computer,a user device, or a resource provider computer, for example. The accessrequest may include authorization information, such as a user name,account number, or password. The access request may also include andaccess request parameters.

The term “access request parameter” generally refers to informationabout the access request and when or how it was made. For example, theparameters of an access request may include one or more of: the timethat the access request was received, the day of the week that theaccess request was received, the amount of resources requested, anidentifier of the resource, the user, the access device, the userdevice, or the request computer, an indication of when, where, or howthe access request is sent or received. Access request parameters andother associated data may be stored for each access request received bya resource provider computer.

The term “scoring model” or “model” may refer to a machine learningmodel or a decision tree that determines scores based on the features orparameters of an access request. “Machine learning” generally refers toa variety of different computer-implemented processes that build modelsbased on a population of input data by using features of the entitieswithin the population and determining the relationships between theentities. To build the model, the machine learning process can measure avariety of features of each entity within the population and thefeatures of different entities can be compared to determine therelationships. For example, a machine learning process can be used topredict the attributes of entities according to their features and therelationships between the entities.

The term “raw score” refers to scores output by the scoring model. Theraw scores are within the range of potential output values used by thescoring model. For example, one scoring model could outputs scoresbetween 0 and 100,000 while another scoring model could output scoresbetween −500,000 (negative) and 500,000 (positive). In some cases, theraw scores may be transformed to be more usable and/or understanding.For example, the raw scores can be transformed into a shorter,abbreviated form. “Abbreviated scores” may be set to correspond toparticular raw scores based on a transformation table or function. Forexample, abbreviated scores of 0 to 99 can correspond to particular rawscores in the range of 0 to 100,000. In another example, abbreviatedscores of 1 to 1,000 can correspond to particular raw scores in therange of −500,000 (negative) and 500,000 (positive). The amount andrange of abbreviated scores may be set according to their intended use.The amount of scores in a set of abbreviated scores may be less than theamount of scores in the corresponding set of raw scores (e.g., one ormore orders of magnitude less). In the embodiments described herein,higher scores indicate that an access request is more risky (e.g., morelikely to be fraudulent) and lower scores indicate that the accessrequest is less risky (e.g., more likely to be legitimate).

The term “top percent risk” or “risk level” corresponds to a particularscore and refers to the percentage of the population (e.g., populationof access requests sampled by the scoring model) that scores at or abovethe particular score. For example, if 10% of the sampled populationscores between 50 to 99 (out of potential scores of 0 to 99), then thescore of 50 is said to be within the top 10% of risk. Also, the “risklevel” would be 10% for the score of 50 in this example. When comparingthe top percent risk between different scores, a score for an accessrequest at a smaller top percent risk may be said to have a higher risklevel compared to another score at a greater top percent risk (e.g., anaccess request at the top 5% of risk has a higher risk level compared toan access request at the top 10% of risk).

The term “access request outcome” may include any determination ofwhether to grant access to the resource. The access request outcomes mayinclude “accept,” “reject,” or “review.” An access request outcome of“accept” may cause the access request to be granted. An access requestoutcome of “reject” may cause the access request to be denied. The“review” outcome may initiate a review process for the access request.The access request outcome for a particular access request may bedetermined based on the score it is assigned and a predetermined scoringthreshold.

The term “reporting” generally refers to a process for identifyingwhether an access request was fraudulent or legitimate. Reporting mayinvolve a user of a resource reporting fraudulent use to the owner oroperator of the resource. Such reporting may be used to determine oradjust validity information (e.g., valid/legitimate orinvalid/fraudulent) for the corresponding access request. For example,if a report of fraudulent access to a resource is received, the validityinformation corresponding to the access request which granted access maybe updated to indicate that the access request was fraudulent.

A “user” can be a person or thing that employs some other thing for somepurpose. A user may include an individual that may be associated withone or more personal accounts and/or mobile devices. The user may alsobe referred to as a cardholder, account holder, or consumer in someembodiments.

A “user device” may comprise any suitable computing device that can beused for communication. A user device may also be referred to as a“communication device” or a “computing device.” A user device mayprovide remote or direct communication capabilities. Examples of remotecommunication capabilities include using a mobile phone (wireless)network, wireless data network (e.g., 3G, 4G or similar networks),Wi-Fi, Wi-Max, or any other communication medium that may provide accessto a network such as the Internet or a private network. Examples of userdevices include desktop computers, videogame consoles, mobile phones(e.g., cellular phones), PDAs, tablet computers, net books, laptopcomputers, personal music players, hand-held specialized readers, etc.Further examples of user devices include wearable devices, such as smartwatches, fitness bands, ankle bracelets, rings, earrings, etc., as wellas automobiles with remote or direct communication capabilities. A userdevice may comprise any suitable hardware and software for performingsuch functions, and may also include multiple devices or components(e.g., when a device has remote access to a network by tethering toanother device—i.e., using the other device as a modem—both devicestaken together may be considered a single communication device).

The term “server computer” may include any suitable computing devicethat can provide communications to other computing devices and receivecommunications from other computing devices. For instance, a servercomputer can be a mainframe, a minicomputer cluster, or a group ofservers functioning as a unit. In one example, a server computer may bea database server. A server computer may include a database or becoupled to a database and may include any hardware, software, otherlogic, or combination of the preceding for servicing the requests fromone or more client computers. For example, the server computer caninclude and operate a relational database. A server computer maycomprise one or more computational apparatuses and may use any of avariety of computing structures, arrangements, and compilations forservicing the requests from one or more client computers. Data transferand other communications between computers may occur via any suitablewired or wireless network, such as the Internet or private networks.

The term “providing” may include sending, transmitting, making availableon a web page or a software application, displaying or rendering, or anyother suitable method of accessing.

A “processor” or “processor circuit” may refer to any suitable datacomputation device or devices. A processor may comprise one or moremicroprocessors working together to accomplish a desired function. Theprocessor may include a CPU that comprises at least one high-speed dataprocessor adequate to execute program components for executing userand/or system-generated requests. The CPU may be a microprocessor suchas AMD's Athlon, Duron and/or Opteron, etc.; IBM and/or Motorola'sPowerPC; IBM's and Sony's Cell processor; Intel's Celeron, Itanium,Pentium, Xeon, and/or Xscale, etc.; and/or the like processor(s).

A “memory” or “system memory” may be any suitable device or devices thatcan store electronic data. A suitable memory may comprise anon-transitory computer readable medium (e.g., a computer readablestorage medium) that stores instructions that can be executed by aprocessor to implement a desired method. Examples of memories maycomprise one or more memory chips, disk drives, etc. Such memories mayoperate using any suitable electrical, optical, and/or magnetic mode ofoperation.

While not necessarily described, messages communicated between any ofthe computers, networks, and devices described herein may be transmittedusing a secure communications protocols such as, but not limited to,File Transfer Protocol (FTP); HyperText Transfer Protocol (HTTP); SecureHypertext Transfer Protocol (HTTPS), Secure Socket Layer (SSL), ISO(e.g., ISO 8583) and/or the like. For example, messages sent between theuser device and the password management server may be sent securecommunication protocols such as those listed above.

II. Resource Security System

A resource security system may receive requests to access a resource. Inorder to determine whether an access request is fraudulent, the resourcesecurity system may include an access server for determining a riskscore for the access request using a scoring model. The resourcesecurity system may also include a configuration system that generatesthe scoring model based on historical access request data andcorresponding validity information. The resource security system isdescribed in further detail below.

FIG. 1 shows a resource security system 100 for providing access toresources, in accordance with some embodiments. The arrows shown in FIG.1 represent the flow or association of information between the elementsof the resource security system 100. The resource security system 100may be used to provide authorized users access to a resource whiledenying access to unauthorized users. In addition, the resource securitysystem 100 may be used to deny fraudulent access requests that appear tobe legitimate access requests of authorized users (e.g., based on thecorresponding authentication information). The resource security system100 may implement scoring models 132 to identify fraudulent accessrequests based on the parameters of the access request. The resourcesecurity system 100 may periodically update the scoring models 132 basedon more recent access request data 172.

The resource security system 100 includes a resource provider computer110. The resource provider computer 110 may control access to physicalresources 114, such as a building or a lockbox, and/or electronicresources 112, such as a local computer account, a digital file ordocument, a network database, an email inbox, a payment account, or awebsite login. In some embodiments, the resource provider computer 110may be a webserver, an email server, or a server of an account issuer.

A user 140 may request access to resources provided by the resourceprovider computer 110 using an access request message. The resourceprovider computer 110 may receive an access request from the user 140via a user device 150 (e.g., a computer or a mobile phone) of the user140. The resource provider computer 110 may also receive the accessrequest from the user 140 via a request computer 120 coupled with anaccess device 160 (e.g., a keypad or a terminal). The request computer120 and the access device 160 may be used in situations where arequesting entity operating the request computer 120 makes the accessrequest on behalf of the user (e.g., a merchant requesting access to apayment account). In some embodiments, the request computer 120 may be aservice provider that is different from the resource provider that ownsor operates the resource provider computer 110.

The access device 160 and the user device 150 may include a user inputinterface such as a keypad, a keyboard, a finger print reader, a retinascanner, a biometric reader, a magnetic stripe reader, a chip cardreader, a radio frequency identification interface, or a wireless orcontactless communication interface, for example. The user 140 may inputauthorization information into the access device 160 or the user device150 to access the resource. The authorization information may includeone or more of a user name, an account number, a token, a password, apersonal identification number, a signature, and a digital certificate,for example. In response to receiving authorization information input bythe user 140, the user device 150 or the request computer 120 may sendan access request to the resource provider computer 110 along with oneor more parameters of the access request. The access request may includethe authorization information provided by the user 140.

In one example, the user 140 may enter one or more of an account number,a personal identification number, and password into the access device160 to request access to a physical resource (e.g., to open a lockedsecurity door in order to access a building or a lockbox) and therequest computer 120 may generate and send an access request to theresource provider computer 110 to request access to that resource. Inanother example, the user 140 may operate the user device 150 to input auser name and password as a request for the resource provider computer110 to provide access to an electronic resource 112 (e.g., a websitelogin or a file) that is hosted by the resource provider computer 110.In another example, the user device 150 may send data or information(e.g., an email) to request the resource provider computer 110 (e.g., anemail server) to provide the data or information access to an electronicresource 112 (e.g., deliver the email to an inbox). In another example,the user 140 may provide an account number and/or a personalidentification number to an access device 160 in order to request accessto a resource (e.g., a payment account) for conducting a transaction.The resource provider computer 110 may also receive access requests inother manners.

In some embodiments, the resource provider computer 110 may verify theauthorization information of the access request based on informationstored at the request computer 120. In other embodiments, the requestcomputer 120 may verify the authorization information of the accessrequest based on information stored at the resource provider computer110. The resource provider computer 110 may grant or deny access to theresource based on the verification of the authorization information.

The resource provider computer 110 may receive the access requestsubstantially in real-time, accounting for delays computer processingand electronic communication. Once the access request is received, theresource provider computer 110 may determine parameters of the accessrequest. In some embodiments, the parameters may be provided by the userdevice 150 or the request computer 120. For example, the parameters ofthe access request may include one or more of: a time that the accessrequest was received, a day of the week that the access request wasreceived, the source-location of the access request, the amount ofresources requested, an identifier of the resource being request, anidentifier of the user 140, an identifier of the access device 160, anidentifier of the user device 150, an identifier of the request computer120, a location of the user 140, a location of the access device 160, alocation of the user device 150, a location of the request computer 120,an indication of when, where, or how the access request is received bythe resource provider computer 110, an indication of when, where, or howthe access request is sent by the user 140 or the user device 150, anindication of the requested use of the electronic resource 112 or thephysical resource 114, and an indication of the type, status, amount, orform of the resource being requested. In other embodiments, the requestcomputer 120 or an access server 130 may determine the parameters of theaccess request.

While the resource provider computer 110 may determine that an accessrequest includes proper authentication information, the resourceprovider computer 110 may send the parameters of the access request tothe access server 130 in order to determine whether the access requestis fraudulent. The access server 130 may store one or more scoringmodels 132 for scoring access requests. Different scoring models may beused for different types of access requests, or may be used in differentsituations. The access server 130 can convert raw scores determined bythe scoring model into an abbreviated form using score transformationtables 134. The abbreviated score can be determined based on a scoringprofile for the request computer 120 and/or the resource providercomputer 110.

The access server 130 can send an indication of the abbreviated score tothe request computer 120 and/or the resource provider computer 110. Insome cases, the access server 130 can also send an indication of the rawscore and the risk level. The request computer 120 and/or the resourceprovider computer 110 may then accept, review, or reject the accessrequest based on one or more scoring thresholds. For instance, if thescore received from the access server 130 is below a “review” thresholdvalue, then the access request may be accepted. And, if the score isabove a “reject” threshold value, then the access request may berejected.

If the access request outcome is “accept,” then the resource providercomputer 110 may provide the user 140 or the user device 150 access tothe resource. If the access request is “reject,” then the resourceprovider computer 110 may not provide the user 140 or the user device150 access to the resource. If the access request outcome is “review”(e.g., a score below a reject threshold and above a review threshold),then the resource provider computer 110 may initiate a review processfor the access request. The review process may involve contacting theuser 140 or another entity involved in requesting access (e.g., theresource provider or another service provider).

The resource provider computer 110 may also store validity informationfor access requests that it receives. The validity information canindicate whether the access request was legitimate or fraudulent. Thevalidity information associated with an access request may initially bebased on the corresponding access request outcome. For instance, thevalidity information may indicate that a granted access request islegitimate and that a rejected access request is fraudulent. Thevalidity information may be updated based on reports received for thataccess request or based on a review process for that access request. Insome embodiments, the access server 130 or the request computer 120 maygenerate and store the access requests and the validity information.

The scoring models 132 and the score transformation tables 134implemented by the access server 130 may be created by a configurationsystem 170. In some embodiments, the functions of the access server 130and the configuration system 170 may be performed by the same server orservers. The configuration system 170 may generate scoring models 176and score transformation tables 178 corresponding to the scoring models176. The scoring models can be generated based on access request data172 and validity information 174 corresponding to the access requestdata 172. The access request data 172 and the validity information 174can be received from the resource provider computer 110 or the accessserver 130. Some of all of the scoring models 176 and correspondingscore transformation tables 178 can be provided to the access server 130for it to implement for real-time scoring of access requests.

The configuration system 170 may periodically receive new or updated theaccess request data 172 and validity information 174 from the resourceprovider computer 110 or the access server 130. The configuration system170 can then re-generate the scoring models 176 and/or update the scoretransformation tables 178 based on the new or updated access requestdata 172 and the validity information 174. As such, the scoring models176 and the score transformation tables 178 may be based on the mostrecent patterns of access requests. The configuration system 170 canthen send the new or updated scoring models 176 and score transformationtables 178 to the access server 130 to be implemented. The generation ofthe score transformation tables 178 is further described below.

III. Score Transformation Table Generation

As mentioned above, one problem that may arise in resource securitysystems is that the risk level associated with a particular risk scoremay change over time. This may occur as resource request behaviorschange over time or when the scoring model is updated because thedistribution of scores may change. The changing distribution of scoresand the resulting change in the risk level of those scores (e.g., thepercent of the sampled population being assigned that score) isproblematic because resources providers and resource requesters may relyon predetermined score thresholds to accept or reject access requests.Thus, the amount of percent of access requests that are rejected changesover time. Certain resource providers may handle thousands, millions, oreven billions of access requests per day. Thus, even a small change inaccept/reject percentages can affect a large number of access requests,enabling fraudulent users to gain access or legitimate users to bedenied access. Therefore, there is a need for scoring systems andmethods that provide consistent scoring over time (e.g., thedistribution of scores is consistent).

Embodiments of the invention generate a score transformation table thatdynamically adapts to changes in the distribution of scores such thatthat scores consistently corresponding to certain risk levels. FIG. 2shows an information flow diagram 200 of a process for building a scoretransformation table 250, in accordance with some embodiments. Theprocess for building (e.g., generating or determining) the scoretransformation table 250 can be performed by a configuration system,such as the configuration system 170 described above with respect toFIG. 1 . In some embodiments, the process for building the scoretransformation table 250 can be performed by an access server (e.g., theaccess server 130 of FIG. 1 ) or a resource provider computer (e.g., theresource provider computer 110 of FIG. 1 ).

Prior to building the score transformation table, the configurationsystem can store access request data 210. The access request data 210can include information for a plurality of previous (e.g., historical)access requests made to a resource provider computer. The access requestdata 210 can include the messages sent as part of the access request,the parameters of the access request, and other information associatedwith the access request (e.g., date, time, and date of week that theaccess request was made). The access request data 210 can be receivedfrom the resource provider computer, the access server, and/or therequest computer. The access request data 210 can be updatedperiodically (e.g., by the minute, hour, day, week, or month). Theaccess request data 210 can be used to build the scoring model 230 andthe access requests within the access request data 210 can be scored bythat scoring model 230.

The configuration system also stores the scoring model 230. In someembodiments, the scoring model 230 can be the same scoring modelcurrently implemented by an access server (e.g., one of the scoringmodels 132 implemented by the access server 130 of FIG. 1 ). In someembodiments, the scoring model 230 can be an updated scoring model builtbased on updated access request data and its corresponding validityinformation.

Also prior to building the scoring transformation table 250, a targetscoring profile table 240 is created. The target scoring profile tablemay be associated with a particular request computer (e.g., the requestcomputer 120 of FIG. 1 ), a particular resource provider computer (e.g.,the resource provider computer 110 of FIG. 1 ), or a particular accessserver (e.g., the access server 130 of FIG. 1 ). As further describedbelow, the target scoring profile table 240 includes a target toppercent value for each abbreviated score in a set of abbreviated scores(e.g., 0-99) based on a first distribution function (e.g., a normaldistribution). That is, the target scoring profile table 240 defines therisk level for each score.

A. Target Scoring Profile

In order to build the target scoring profile table 240, the range or setof abbreviated scores must be defined. In some embodiments, the set ofabbreviated scores can includes integers between 0 and 99. In someembodiments, other ranges of abbreviated scores are used (e.g., 1-10,−100 to +100, 0 to 1,000, etc.). The set of abbreviated scores can bepredetermined, or it can be set by a user of the configuration systemusing a graphical user interface.

At step 205, once the set of abbreviated scores is defined, theconfiguration system can obtain target scores and risk levels. To obtainthe target scores and risk levels (e.g., top percent risk), theconfiguration system can provide a graphical user interface. Thisgraphical user interface can be used by a resource provider entity, aresource requester entity, or an access server entity.

FIG. 3 shows a graphical user interface 300 for creating a targetscoring profile, in accordance with some embodiments. The graphical userinterface (GUI) can be used for configuring the score transformationtable 250. The GUI 300 can include a first user interface element 301that enables a user (e.g., of the configuration system), different fromthe user 140 of FIG. 1 , to input scoring profile configuration values(e.g., density of a score, top percent value for a range of scores, andthe statistical mode of the scores). For instance, the first userinterface element 301 can be used to set score densities (e.g.,population densities for abbreviated scores and target top percentvalues for a range of scores. In the example GUI shown in FIG. 3 , theuser can set the abbreviated score of 20 to have a population density of0.05% and the abbreviated score of 99 to also have a population densityof 0.05%. Accordingly, 0.05% of a sample of historical access requestswill be assigned a score of 20 (and 99 likewise) using the scoring modeland the score transformation table.

The user may also assign a density percentage to other scores. Inaddition, the user can set, via the first user interface element 301, arange of abbreviated scores between 50-99 to be at the top 6%. That is,the top 6% of scores determined using the scoring model and the scoretransformation table on the sample of historical access requests will bewithin the range of 50-99. The user may also assign a top percent valueto other ranges of scores. The user can also set, via the first userinterface element 301, a “mode” score (e.g., statistically, the scorethat will be assigned most frequently) for the distribution used for thescoring profile.

The scoring profile configuration values input by the user can be usedto determine a distribution of scores across the entire set ofabbreviated scores. This is done using a distribution function.Different types of distribution functions can be used. For example, thedistribution function could be a normal distribution, a Cauchydistribution, a student's t-distribution, a logistic distribution, agamma distribution, or a beta distribution. The GUI can include a seconduser interface element 302 for selecting a distribution type for thedistribution function. If multiple distribution functions are used tomap scores to percentages, different distribution types can be used foreach distribution. The configuration system can receive inputs to thesecond user interface element 302 (e.g., selecting a checkbox) where theinputs indicates the distribution type for the distribution function.

These scoring profile configuration values input into the first userinterface element 301 along with the distribution type selected in thesecond user interface element can be used to determine a scoredistribution, as shown as a graph in a third user interface element 303.For example, the mode of the score distribution can be 20, as set in thefirst user interface element 301. In addition, the population percentage(e.g., density) for score 0 and 99 can both be 0.05%, as set in thefirst user interface element 301. The score distribution graph showsfrequency counts of each score divided by the total number of sampledaccess requests across the score range. A fourth user interface element304 shows a curve of the top percent risk for each score. The toppercent risk curve is based on the integral of the score distributionand shows the cumulative of the frequency counts of access requestshaving a score greater than x, divided by the total number of all accessrequests. For example, the top percent risk curve in the fourth userinterface element 304 shows that the abbreviated scores in the range of50 to 99 account for the top 6% of the population, as set in the firstuser interface element 301.

Thus, the graphs in the third user interface element 303 and the fourthuser interface element 304 depict the target scoring profile as set bythe scoring profile configuration values. The top percent risk curveshown in the fourth user interface element 304 can be represented as atable, which is the target score profile table 240.

As shown in FIG. 3 , the top percent risk curve is smooth (e.g.,continuously differentiable). The top percent risk curve is smoothbecause the score distribution that it is based on is defined by adistribution function (e.g., a normal distribution) or severaldistribution functions. Having a smooth top percent risk curve isadvantageous because it provides consistency and predictability. Forinstance, a score of 51 can predictably be at a slightly lower toppercent risk compared to a score of 50. Certain prior scoring systemsdid not have such consistency and predictability in scoring becausetheir scores are not based on the distribution of raw scores determinedby the scoring model.

FIG. 4 shows graphs illustrating non-smooth score distributions. Thesegraphs include a score distribution graph 410 and its corresponding toppercent risk curve, shown the lower graph 420.

The score distribution shown in graph 410 illustrates some issues thatmay arise in scoring methods that do not dynamically account forvariations in score distribution over time. One issue that can arise isthat the concavity of the curve can change, causing the curve to beunsmooth (e.g., the slope at that point changes from positive tonegative or from negative to positive). For example, in the scoredistribution graph 410, the concavity of the curve changes at score 34,score 50, and score 92. This spike in density causes unpredictability inthe top percent risk curve, which flips from a concave-up curve betweenscore 10 and score 30 to a concave-down curve between score 31 and 38.Such spikes in the distribution curve may cause unpredictability indecision making by the access server based on such a distribution.

The top percent risk curve then changes back to a concave-up curve atscore 39, but then the curve slope flattens between scores 50 and 80.The curve flattens because the density of scores between 50 and 80 issmall as shown in the score distribution graph. The high variability indensity between adjacent scores causes unpredictability and causescertain scores to lose meaning. For instance, a score of 20 is withinthe top 27% of risk while a score of 30 is in the top 18% of risk. Bycontrast, a score of 50 and a score of 60 are both at the top 8% of riskwhen rounded. Thus, scores between 50 and 60 have little meaning becausethere is little change in their corresponding risk levels.

The issues in the score distribution and top percent risk curves ofprior scoring systems shown in FIG. 4 can arise due to the changes inscore distribution over time, which occur based on changes in accessrequest making behavior or scoring model updates, as discussed above.

FIG. 5 shows graphs illustrating changes in risk level per score overtime. The first graph 501 shows changes in score distribution by month.For example, in a prior scoring system, a score of 10 can correspond toa lower percentage of the population in the year 2017 compared to theyear 2016 while a score of 40 can correspond to a greater percentage inthe year 2017 compared to score 40 in 2016. The second graph 502 showsan example of the changes in top percent risk that can occur in priorscoring systems when the scoring model is updated. As shown in thesecond graph 502, the score of 30 can corresponding to the top 40% mostrisky access requests in the prior model while the score of 30corresponds to the top 65% most risky access requests in the updatedmodel. This drastic change in the top percent risk curve isdisadvantageous because the score is 30 is much less risky in theupdated model compared to the prior model.

In addition, the risk level of scores in prior score systems can varyday-by-day. FIG. 6 shows graphs illustrating risk level oscillation byday of week. As shown in the first graph 601, the top percent risk curvefor the same score (e.g., the raw score of 5,000) can oscillate up anddown each week over a month. For instance, the raw score of 5,000 cancorresponds to the top 28% most risky access requests on the 9^(th) dayof a month but then correspond to the top 33% most risky access requestson the 12^(th) day of the month. In addition, as shown in the secondgraph 602, the top percent risk curve for the same score (e.g., the rawscore of 5,000) can be different on different days of the week. Forinstance, the raw score of 5,000 can correspond to the top 39% mostrisky access requests on Wednesday of the 12^(th) recorded week whilethe same raw score of 5,000 corresponds to the top 31% most risky accessrequests on Saturday of the same week (the 12^(th) recorded week). Thisoscillation can occur even when the scoring model considering the day ofthe week and/or date of the month it its scoring calculation. The driftand oscillation of the distribution of scores, and the resulting changesin the top percent risk curves, as shown in FIGS. 4, 5, and 6 isdisadvantageous because resource providers and resource requesters maynot be able to rely on the score number itself, since the meaning haschanged.

The score transformation table 250 of FIG. 2 , which is dynamicallyadjusted to account for changes in the score distribution over time andday-by-day, solves the problems experienced by prior scoring systems.Unlike the top percent risk curves of prior scoring systems, the toppercent risk curve shown in the graph of the fourth user interfaceelement 304 of FIG. 3 (representative of the score transformation table250) is smooth and predictable.

At step 206 of FIG. 2 , in order to create a smooth top percent riskcurve, the configuration system can determine conjugate functions, anduse the conjugate functions to modify distribution functions to map tothe target scores and corresponding risk levels input by the user (e.g.,as shown in first user interface element 301 of FIG. 3 ).

FIG. 7 shows graphs of a target scoring profile based on distributionfunctions and conjugate functions, in accordance with some embodiments.The first graph 701 of FIG. 7 shows two normal distribution functions.The first normal distribution on the left side of the graph 701 has amean of 20 and a standard deviation of 7.7645 and is graphed from score0 to score 20. This left distribution function is determined based onthe score of 20 being set to the top 50% of risk in the first userinterface element 301 of FIG. 3 . Thus, the mean (20) and the standarddeviation (7.7645) are determined based on the score of 20 being set tothe top 50% of risk. Accordingly, area under the curve of the firstdistribution function between score 0 and score 20 is 50%, correspondingto the top 50% of risk. The configuration system can determine the meanto use for the distribution functions based on the scoring profileconfiguration values input by the user.

A second distribution function, shown in the right side of the firstgraph 701 is determined based on the score of 50 being set to the top 6%of risk in the first user interface element 301 of FIG. 3 . The rightdistribution is determined to be a normal distribution having a mean of20 (the same as the left distribution) and a standard deviation of19.2956. The mean (20) and the standard deviation (19.2956) aredetermined based on the score of 50 being set to the top 6%.Accordingly, the area under the curve of the second distribution betweenscore 50 and score 99 is equal to 6%, corresponding to the top 6%. Themean of the second distribution is determined to be 20 such that thesecond distribution has the same mean as the first distribution.

As shown in the first graph 701, the left distribution and the rightdistribution are not equal at score 20. A conjugated function, as shownin the second graph 702, is applied to each point (e.g., score) on thefirst graph 701 to create a target score profile curve that is smooth(e.g., the left distribution and right distributions in the first graph701 are multiplied by the conjugated function in the second graph 702).The conjugate function may be an exponential probability distribution.For example, the conjugated function can be defined as shown in formula(1) below:

f(x)=Ae ^(−Bx)  (1)

The term “conjugate function,” as used herein, refers to a set ofcurves/functions (e.g., those in the second graph 702) that can beapplied (e.g., using multiplication) to disjoint left and rightdistribution curves (e.g., the first and second distribution functionsin the first graph 701) such that the resulting curve is smooth (e.g.,the curve in the third graph 703). As shown in the second graph 702, the“conjugate function” can have left, middle, and right portions wheredifferent variables are used (e.g., different values of A and B). Thus,the conjugate function acts as an adjustment function to create a smoothconnection between two non-continuous functions (e.g., two functionsthat are not continuously differentiable).

As shown in the second graph 702, the conjugated function between scores0 and 20 is defined by setting variable A equal to 1 and variable Bequal to −0.1513. The conjugated function between scores 20 and 35 isdefined by setting variable A to 2.4609 and variable B to 0.0601. Theconjugated function between scores 35 and 99 is defined by settingvariable A to 1 and variable B to 0. The configuration system thenapplies the conjugated function shown in the second graph 702 to theleft and right distribution functions shown in the first graph 701 ofFIG. 7 . The resulting graph is called the target score profile and isshown in the third graph 703 of FIG. 7 . By multiplying the leftdistribution by the conjugated function between scores 0 and 20, thetarget score profile curve is made lower and steeper compared to theleft curve, due to the conjugated function values at those points beingbelow 1. By multiplying the right distribution by the conjugatedfunction between scores 20 and 35, the target score profile curve isincreased compared to the right distribution of the first graph 701 suchthat it meets and is equal to the left distribution function as modifiedby the conjugated function. This is a result of the conjugated functionbeing greater than 1.0 between scores 20 and 35. As shown in the thirdgraph, the left distribution modified by the conjugated function isequal to the right distribution as modified by the conjugated functionare equal (e.g., both are at 5%). Furthermore, the conjugated functionis equal to 1 from scores 35 to 99, and thus, the target score profilecurve from scores 35 to 99, as shown in the third graph 703, is notmodified from the right distribution shown in the first graph 701. Thevariables A and B in the left, middle, and right conjugated function areset such that the left distribution and the right distribution, asmodified by the conjugated function, are equal to each other at score20.

Thus, at step 207 of FIG. 2 , the configuration system has determinedthe target scoring profile. The points along the target scoring profilecan be converted into a target score profile table 240. An example ofthe target score profile table 240 is shown in Table 1 below. As shownin Table 1, the score of 20 is set to 50%, the score of 50 is set to 6%,as discussed above. In Table 1 below, only a few of the target scoresare shown for simplicity. Scores not shown are indicated by an ellipsis( . . . ). The target score profile table 240 is used in generating thescore transformation table 250, as further described below.

TABLE 1 Target score profile Target Score Profile Target Score TopPercent Risk 5 99.29% 20   50% 36 22.77% 45 12.01% 50    6% 88  0.57% 94 0.26%

B. Trending Top Percent Risk Table

To determine the score transformation table 250, a dynamic trending toppercent risk table 245 (e.g., determined using current data) is mappedto the target scoring profile table 240. The target scoring profiletable 240 defines the target scores and their corresponding risk levelswhile the trending top percent risk table 245 dynamically adapts tochanges in score distribution over time.

At step 201, to generate the trending top percent risk table 245, asample of the previous access requests stored in the access request data210 are selected. In some embodiments, the trending top percent risktable 245 accounts for differences in score distribution and risk levelacross different weekdays. In such embodiments, seven different samplesare selected from the access request data 210, one for sample for eachday of the week. The samples can be selected based on a maximum numberof samples and/or a minimum number of samples. For example, the sampledata may be selected to include a minimum of 1,000,000 samples. Thesample access requests can also be selected based on a timeline. Forexample, access requests made in the last 7 days, or the last 14 days,etc., can be used for the sample. Furthermore, where the day of week isaccounted for, the sample selection for Mondays can be based on the last7 Mondays, or the last 14 Mondays, for example. The configuration systemcan provide a sample selection user interface enabling a user to setsample data collection criterion (e.g., sample size, timeline withinwhich to pull samples, days of the week to sample, etc.). Theconfiguration system can receive the sample data selection criterionfrom the user via the sample selection user interface element of thegraphical user interface. The configuration system can use the sampleselection criterion to sample the historical access requests.

At step 202, the sampled access requests can be scored by the scoringmodel 230, which can determine raw scores for each of the accessrequests. Then, the top percent risk for each raw score can bedetermined based on the distribution of scores for each sample. Forinstance, the top percent risk for each potential output value (e.g.,0-100,000) can be determined for Mondays, Tuesdays, and the otherweekdays. The top percent risk values for each sample selection (e.g.,for each day of the week) and the corresponding raw scores are definedin the trending top percent risk table 245. These top percent risks arecalled “trending” top percent risks because the configuration system canupdate (e.g., recalculate) the trending top percent risk table 245periodically (e.g., every day, every 7 days, bi-weekly, or monthly).Thus, the trending top percent risk table 245 ensures that the scoretransformation table 250 accounts for changes in score distribution overtime, and by weekday. An example of the trending top percent risk table245 is shown in Table 2 below. As shown in Table 2, the same raw scoremay correspond to a different top risk percent on different days of theweek. In Table 2 below, only a few of the raw scores are shown forsimplicity. Scores not shown are indicated by an ellipsis ( . . . ). Thetrending top percent risk table 245 is used in determining the scoretransformation table 250, as further described below.

TABLE 2 Trending Top Percent Risk Top % Top % Top % Top % Top % Top %Top % Raw Risk Risk Risk Risk Risk Risk Risk Score Sunday Monday TuesdayWednesday Thursday Friday Saturday . . . . . . . . . . . . . . . . . . .. . . . .  3,717 42.0242% 43.2262% 43.8287% 45.1392% 45.2397% 44.9573%41.8744% . . . . . . . . . . . . . . . . . . . . . . . . 13,849 12.0138%13.2437% 13.5678% 15.9845% 16.3457% 14.5646% 12.8753% . . . . . . . . .. . . . . . . . . . . . . . . 90,282  2.2911%  2.6458%  2.9855%  3.8743% 3.9374%  2.7563%  2.1782% . . . . . . . . . . . . . . . . . . . . . . .. 99,879  0.2552%  0.2236%  0.3587%  0.4513%  0.5274%  0.3567%  0.2655%. . . . . . . . . . . . . . . . . . . . . . . .

As shown in Table 2 above, and discussed above with respect to FIG. 6 ,the risk level (e.g., the top % top) for a particular score mayoscillate up and down depending on the weekday.

In some embodiments, the configuration system determines the trendingtop percent values for a subset of the potential outcome values. Forinstance, the configuration system can determine the trending toppercent values for a certain percentage (e.g., 10% or 1%) of thepotential outcome values. The trending top percent values for theremaining percentage can be determined using a linear transformationbased on the other trending top percent values (e.g., those determineddirectly). The percent of can be determined based on the total number ofpotential outcome values for the scoring model.

At step 204, to reduce variability across weekdays, the configurationsystem can filter the top percent risk values for each weekday. Thefilter can adjust the top percent risk values based on a moving orweighted average. For instance, the configuration system can determinethe average of the top percent risk values for the current Wednesday andthe top percent risk values a certain number of the previous Wednesdays(e.g., the past 4, 7, or 14 Wednesdays, etc.). The filtering can beperformed using any suitable digital filter (e.g., a Kalman filter). Theconfiguration system can determine different weighting factors to beused in filtering the top percent risks for different weekdays. Theconfiguration system can select a lower weighting factor (e.g., morefiltering) on weekdays that are noisier (e.g., Wednesdays, as shown inthe second graph 602 of FIG. 6 ). The configuration system can select ahigher weighting factor (e.g., less filtering) on less noisy week days(e.g., Saturdays, as shown in the second graph 602 of FIG. 6 ). Thetrending top percent risk table 245 is then updated to include thefiltered trending top percent risks. Thus, the trending top percent risktable 245 and the score transformation table 250 can account forvariations in risk level by day of week.

The configuration system can include user interface elements forconfiguring the filtering step described above. The configuration systemcan provide a graphical user interface including a filtering userinterface element for indicating or inputting a digital filteridentifier identifying a type of digital filtering algorithm (e.g.,Kalman filter) and weighting factors (e.g., 0.2, or 0.5, etc.) to use infiltering the trending top percent values for each potential outputvalue. The configuration system can receive input to the filtering userinterface element from a user. The input can include the digital filteridentifier identifying the type of digital filtering algorithm to useand the weighting factor to use. In addition, the configuration systemcan provide a weighting factor user interface element that presents oneor more graphs of trending top percent risk curves, and/or one or moretables corresponding to the one or more graphs of trending top percentrisk curves. Each of the graphs and tables can be based on differentweighting factors and filtering algorithm types.

C. Score Transformation Table

At step 208, after determining the target score profile table 240 andthe trending top percent risk table 245, the configuration system candetermine the score transformation table 250. As discussed above, thetarget score profile table 240 maps abbreviated target scores (e.g., 0to 99) to target top percent risk values (e.g., 50% for score 20 and 6%for score 50, as shown in Table 1) while the trending top percent risktable 245 maps raw scores within the potential output values of thescoring model 230 (e.g., scores between 0 and 100,000) to the trendingtop percent risk recently determined by the configuration system (e.g.,42.0242% for raw score 3,717 on Sundays and 2.7563% for raw score 90,282on Fridays, as shown in Table 2). The configuration system candetermines the score transformation table 250 using the target scoreprofile table 240 and information from the trending top percent risktable 245.

For each abbreviated score in the target score profile table 240, theconfiguration system can determine the potential output value (e.g., rawscore) in the trending top percent risk table 245 that is within athreshold of the target top percent risk associated with thatabbreviated score in the target score profile table 240. In someembodiments, the configuration system can determine the potential outputvalue (e.g., raw score) in the trending top percent risk table 245 that,compared to other potential output values, has the closest trending toppercent risk to the target top percent risk associated with thatabbreviated score in the target score profile table 240. Theconfiguration system can associate that raw score with the abbreviatedscore.

For example, a target score profile table 240 can have the abbreviatedscore of 50 set to a target top percent risk of 6%, meaning that anaccess request being scored at 50 would be in the top 6% of riskiestaccess requests (e.g., riskier than 94% of access requests). In thisexample, the trending top percent risk table 245 can have the potentialoutput value of 45,743 associated with a trending top percent risk of6.0024%. That is, out of the training sample, the raw score of 45,743 isin the top 6.0024% of the most risky access requests (e.g., a raw scoreof 45,743 is riskier than 93.9976% of access requests in the sample ofaccess requests). In this example, the trending top percent risk table245 associates the raw score of 45,742 with a trending top percent riskof 5.9912%. For the potential output value of 45,743, the differencebetween its associated top percent risk (6.0024%) and the target toppercent risk (6%) for the abbreviated score of 50 is 0.0024%. For thepotential output value of 45,742, the difference between its associatedtop percent risk (5.9912%) and the target top percent risk (6%) for theabbreviated score of 50 is 0.0088%. Therefore, the difference (0.0024%)between the top percent risk value (6.0024%) and the target top percentrisk value (6%) for the potential output value of 45,743 is less thanthe difference (0.0088%) between the top percent risk value (5.9912%)and the target top percent risk value (6%) for the potential outputvalue of 45,743 (e.g., 0.0024% is less than 0.0088%). Thus, thepotential output score of 45,743 has a top percent risk value that iscloser to the target top percent risk value compared to the potentialoutput score of 45,742 (and every other potential output value).

In other embodiments, the configuration system can use a threshold valueto identify a corresponding potential output value. In such embodiments,the more than one potential output value may have a trending top percentrisk value that is within the threshold.

Thus, the score transformation table 250 can provide abbreviated riskscores that maintain a consistent risk level over time and providerpredictability day-by-day even though the raw scores output by thescoring model 230 have risk levels that drift over time and thatoscillate day-by-day. An example of the trending top percent risk table245 is shown in Table 3 below. As shown in Table 3, the same raw scoremay correspond to a different top risk percent on different days of theweek. In Table 3 below, only a few of the target scores, correspondingraw scores, and correspond target and trending top percent risks areshown for simplicity. In addition, Table 3 below only scores thetrending top percent risk for Mondays for simplicity, but the scoretransformation table 250 can include trending top percent risks for eachweekday. Scores not shown are indicated by an ellipsis ( . . . ).

TABLE 3 Score Transformation Table Trending Top Top % Target PercentRisk Raw Score Risk Monday Score 5 99.29% 99.2916% 870 20   50% 50.0254%1,926 36 22.77% 22.7717% 6,800 45 12.01% 12.0138% 13,849 50    6%6.0024% 45,743 88  0.57% 0.5697% 99,631 94  0.26% 0.2552% 99,879

D. Exemplary Method for Processing Access Requests

An exemplary method for processing access requests can be performed by acomputer system, such as the configuration system described above. FIG.9 shows a flowchart of a method for processing access requests, inaccordance with some embodiments. At step 901, the method can includedetermining, by the computer system using a scoring model, raw scoresfor a plurality of previous access requests. Each of the raw scoresdetermined sing the score model can be within a set of potential outputvalues of the scoring model. For example, the scoring model may havepotential output values of integers between, and including, 0 and100,000. The scoring model may assigned each access request of theprevious access requests a raw scores from this set of numbers. Theplurality of previous access requests can be obtained by taking a samplefrom a larger set of stored access requests.

In some embodiments, the wherein the scoring model can generated basedon validity information corresponding to the plurality of previousaccess requests. The scoring model can be generated by the computersystem. The validity information can indicate whether each accessrequest of the plurality of previous access requests is fraudulent orlegitimate. The validity information and the plurality of previousaccess requests can be received from a resource provider computer, arequest computer, or an access server.

At step 902, the method can further include determining, by the computersystem for each potential output value of the set of potential outputvalues, a percentage of the raw scores that equal the potential outputvalue. That is, the computer system can determine the distribution ofthe raw scores for the plurality of access requests across the potentialraw scores (e.g., 0-100,000). This percentage represents the density ofthe raw scores in the sample.

At step 903, The method can further include determining, by the computersystem, a trending top percent table. The trending top percent table caninclude a trending top percent value for each potential output value.The trending top percent value for a particular potential output valuecan be based on the percentages of the raw scores that are equal to orgreater than the potential output value.

In some embodiments, the trending top percent table can include trendingtop percent values for each potential output value (e.g., each rawscore) for each weekday (e.g., Monday, Tuesday, etc.). In suchembodiments, the determining of the percentage of the raw scores thatequal the potential output value can be performed for each weekday basedon raw scores for previous access requests occurring on that weekday.

In some embodiments, the method can further include filtering, by thecomputer system using a filtering algorithm, the trending top percentvalues for each potential output value for each weekday. The trendingtop percent values can be filtered using a filtering algorithm (e.g., aKalman filter) based on historical trending top percent values for thepotential output value on the weekday.

At step 904, the method can further include determining, by the computersystem, a first distribution function using a first predetermined toppercent value for a first abbreviated score of a set of abbreviatedscores (e.g., 0-99). The method can further include determiningparameters of the distribution function (e.g., a particular mean andstandard deviation). In some embodiments, the set of abbreviated scorescan be at least one order of magnitude smaller than the set of potentialoutput values of the scoring model. The first distribution function canmap each abbreviated score in the set of abbreviated scores to a targetpopulation percentage for the abbreviated score. A type of the firstdistribution function can be a normal distribution, a Cauchydistribution, a student's t-distribution, a logistic distribution, agamma distribution, or a beta distribution. The set of abbreviatedscores includes the first abbreviated score. The abbreviated score andthe corresponding target population percentage can be based on a targettop percent risk value set in a graphical user interface.

At step 905, the method can further include determining, by the computersystem, a scoring profile table. The scoring profile table can includesa target top percent value for each abbreviated score in the set ofabbreviated scores (e.g., 0-99) based on the first distributionfunction.

In some embodiments, the method can further include determining, by thecomputer system, a second distribution function using a secondpredetermined top percent value for a second abbreviated score. Thescoring profile table can be determined based on the second distributionfunction. In some embodiments, a type of the first distribution functioncan be different than a second type of the second distribution function.

In some embodiments, the method can further include determining, by thecomputer system, one or more conjugate functions based on the firstdistribution function and the second distribution function. Then, themethod can further include transforming, by the computer system, atleast one of the first distribution function and the second distributionfunction using one or more conjugate functions. The scoring profiletable can be determined based on the transformation using the one ormore conjugate functions. The conjugate functions can enable multiplepredetermined top percent values to get set for correspondingabbreviated scores, which may require multiple distribution functions inorder to be map the score distribution to fit the multiple predeterminedtop percent values.

At step 906, the method can further include determining, by the computersystem, a score transformation table. The computer system can determinethe score transformation table by determining, for each abbreviatedscore in the set of abbreviated scores (e.g., 0-99 score), acorresponding potential output value (e.g., 0-100,000 raw score). Thecorresponding potential output value can be determined based on thetrending top percent value for the corresponding potential output valuebeing within a threshold of the target top percent value for theabbreviated score. The threshold can be a predetermined percent value,such as 0.0005%, 0.01%, 0.05%, or 0.1%, for example. The threshold canalso be used to determine the trending top percent value that is closestto the target top percent value. That is, the configuration system candetermine the potential output value of the scoring model that has atrending top percent value that is closer to the target top percentvalue for the abbreviated score compared to the trending top percentvalues for other potential output values. The score transformation tablecan be configured to determine a first abbreviated score based on afirst raw score for a first access request, where the first raw scorecan be determined using the scoring model. The score transformationtable may be used by an access server to score access requests. Thefirst abbreviated score can indicate an access request outcome for thefirst access request (e.g., accept, review, or reject). The accessrequest outcome can also be based on a scoring threshold set by aresource provider computer or a request computer.

While the steps 901-906 in FIG. 9 are shown as occurring in sequence,these steps can be performed in a different order and certain steps maybe performed in parallel. For example, step 904 may be performed beforestep 905, and steps 904 and 905 can be performed at any time, withrespect to steps 901-903, but before step 906.

A computer system may be used to implement any of the entities orcomponents described herein. Subsystems in the computer system areinterconnected via a system bus. Additional subsystems include aprinter, a keyboard, a fixed disk, and a monitor which can be coupled toa display adapter. Peripherals and input/output (I/O) devices, which cancouple to an I/O controller, can be connected to the computer system byany number of means known in the art, such as a serial port. Forexample, a serial port or external interface can be used to connect thecomputer apparatus to a wide area network such as the Internet, a mouseinput device, or a scanner. The interconnection via system bus allowsthe central processor to communicate with each subsystem and to controlthe execution of instructions from system memory or the fixed disk, aswell as the exchange of information between subsystems. The systemmemory and/or the fixed disk may embody a computer-readable medium.

IV. Access Request Scoring and Determining Access Outcomes

As discussed above, a configuration system can determine a scoretransformation table using access request data for recently processedaccess requests. The score transformation table is configured todetermine an abbreviated score, which is associated with a target toppercent risk value, based on a raw score output by the scoring model,the raw score being associated with a trending top percent risk values.The configuration system can provide the scoring model and the scoretransformation table to an access server for use in scoring real-timeaccess requests. For example, the access server 130 of FIG. 1 canperiodically receive scoring models 132 and score transformation tables134 from the configuration system 170.

FIGS. 10 and 11 relate to access request scoring and determine accessrequest outcomes. FIG. 10 shows a process for scoring access requestsand FIG. 11 shows a process that determines an access request outcomebased on the scoring of the access request. These processes can beperformed by an access server (e.g., the access server 130 of FIG. 1 ).In some embodiments, these processes can be performed by a server thatoperates as both an access server and a configuration system (e.g., theconfiguration system 170 of FIG. 1 ).

FIG. 10 shows a process for using a score transformation table todetermine an abbreviated score for an access request, in accordance withsome embodiments. This process can be performed by an access server(e.g., the access server 130 of FIG. 1 ).

At step 1001 of the process, the access server can receive a requestmessage include access request information. The access requestinformation can correspond to a first access request sent to a computingdevice, such as a resource provider computer (e.g., the resourceprovider computer 110 of FIG. 1 ) or a request computer (e.g., therequest computer 120 of FIG. 1 ). The request message can be receivedfrom that computing device over a network. The access requestinformation in the request message can include an access request message(e.g., including an account name, a resource identifier, a requestcomputer identifier, a requested resource amount, etc.). The requestmessage can also include parameters of the access request (e.g., a date,a weekday, a time, a location in which the access request was made,etc.).

At 1002, the access server can generate detector results and determineassociated penalties. The detector results and penalties are independentmodel input features in the scoring model for generating the raw score.

At 1003, the access server can determine a first raw score for the firstaccess request using the scoring model. That is, the access requestinformation and/or the parameters of the first access request can beinput to the scoring model, which can determine and output the first rawscore. The scoring model can determine the first raw score, from a setof potential output values, based on the features the access requestinformation and/or the parameters of the first access request. Forexample, the scoring model may have potential output values of 0 to100,000 and the first raw score may be 45,743.

At step 1004, the access server can determine a target scoring profileand associated score transformation table to use for the first accessrequest. Different resource providers and resource requestors may beassociated with different target scoring profiles and different scoretransformation tables. The access server can determine the particularscore transformation table to use based on a scoring profile identifierprovided with the first access requests.

At step 1005, the access server can determine the trending top percentvalue for the first raw score using the score transformation table. Theaccess server can look up the first raw score (e.g., the potentialoutput value) in the trending top percent risk table and determine whichtrending top percent risk value is associated with the first raw score.For example, the trending top percent risk table can associate thepotential output value of 45,743 with a trending top percent risk valueof 6.0024%. Trending top percent risk tables can be periodicallyprovided to the access server by the configuration system. When a new orupdated trending top percent risk table is received, the access servercan use it to update the score transformation table.

In some embodiments, the trending top percent risk table can beconfigured to determine top percent risk values based on the weekdaythat the access request was received. In this example, the first accessrequest, which is being scored, can be received on a Monday. The accessrequest parameters provided along with the access request informationfor the first access request can include an identifier of the weekday.In such embodiments, the access server can determine which trending toppercent risk value is associated with both the first raw score and theday of week. In this example, the raw score of 45,743 may be associatedwith the trending top percent risk value of 6.0024% on Mondays. Thetrending top percent risk table may have different trending top percentrisk values associated with different days of the week for raw scores of45,743 (e.g., due to the variation of raw scores between different daysof the week, as discussed above). In some embodiments, the access servercan store scoring profile tables and periodically receive updatedtrending top percent risk tables from the configuration system. In someembodiments, the corresponding abbreviated score can be determined bythe access server periodically, or in real time.

At step 1006, the access server can determine a correspondingabbreviated score for the first raw score in the score transformationtable. The access server can determine the corresponding abbreviatedscore based on which potential output value has a trending top percentrisk value within a threshold (or, which is closest) to the target toprisk value for the corresponding abbreviated score. These steps may beperformed because the score transformation table may not include entriesfor each potential output value of the set of potential output values.

In some embodiments, the corresponding abbreviated score can bedetermined based on the first raw score being greater than a second rawscore associated with the corresponding abbreviated score and less thana third raw score associated with the next abbreviated score after thecorresponding abbreviated score (e.g., the next abbreviated score is 1greater than the corresponding abbreviated score).

For example, the scoring model may assign (e.g., determine) a raw scoreof 45,921 for a particular access request. However, the scoretransformation table may not include an entry for the potential outputvalue of 45,921. In this situation, the access server can determinewhich potential output value in the score transformation table isclosest to 45,921. In this example, the score transformation table mayinclude potential output values of 45,743 (corresponding to abbreviatedscore 50) and 46,443 (corresponding to abbreviated score 51).Accordingly, the access server can determine that the raw score of45,921 is closer to the potential output value of 45,743, compared tothe potential output value of 46,443 (e.g., based on the mathematicaldifference). In this situation, the access server can use the potentialoutput value of 45,743 to determine the abbreviated score (e.g., 50),since it is the closest to the raw score. In another embodiment, theaccess server can determine that the raw score of 45,921 corresponds tothe abbreviated score of 50 based on the raw score of 45,921 beinggreater than or equal to 45,743 (corresponding to abbreviated score 50)and less than 46,443 (corresponding to abbreviated score 51).

At step 1007, the access server can provide the abbreviated score to theresource provider computer or the request computer. The abbreviatedscore can be sent to the same computer that provided the access requestinformation to the access server. The abbreviated score can be used todetermine whether the first access request should be accepted, reviewed,or rejected. In some embodiments, the access request outcome can bebased on a scoring threshold. For example, a resource request computercan set thresholds such that abbreviated scores of 50 or greater shouldare rejected, an abbreviated scores greater than or equal to 45 but lessthan 50 are reviewed, and abbreviated scores less than 45 are accepted.

Thus, the process of FIG. 10 can be used to determine a score for anaccess requests. Such scores can be used in determining an accessrequest outcome for the access request (e.g., accept or reject it).Access to the resource can be granted or denied based on the accessrequest outcome.

FIG. 11 shows a method for processing an access request, in accordancewith some embodiments. The method can be performed by an access server(e.g., the access server 130 of FIG. 1 ).

At step 1101, the access server can receive access request information.The access request information can be included in a request messagereceived from a computing device over a network. The access requestinformation can correspond to a first access request, which can be arequest to access a particular resource.

At step 1102, the access server can determine a first raw score for thefirst access request using a scoring model. The scoring model candetermine the first raw score based on features of the first accessrequest information. The scoring model can output scores within a set ofpotential output values (e.g., 0 to 100,000, or −50,000 to 50,000,etc.). The first raw score can be within a set of potential outputvalues of the scoring model. A score output by the scoring model can becalled a raw score.

At step 1103, the access server can access a score transformation table.That is, the access server can access the memory to obtain the scoretransformation table. The memory can be a system memory of the accessserver (e.g., a memory circuit coupled to one or more processorcircuits). The score transformation table can be used to determineabbreviated score (e.g., 0 to 99) from raw scores (e.g., 0 to 100,000).The score transformation table can associate each abbreviated score in aset of abbreviated scores (e.g., 0 to 99) with a corresponding potentialoutput value of the set of potential output values (e.g., 0 to 100,000).The score transformation table can be determined based on target toppercent risk values for the abbreviated scores (e.g., the riskiness ofan access request having the abbreviated score compared to thepopulation of scored access requests). The score transformation tablecan also be determined based on a distribution of raw scores for aplurality of previous access requests across the set of potential outputvalues (e.g., the percentage of the population of historical accessrequests scored at particular raw scores).

In some embodiments, the score transformation table can furtherassociate each potential output value in the score transformation tablewith a trending top percent value. The trending top percent value for aparticular potential output value can be determined based on apercentage of raw scores for the plurality of previous access requeststhat are equal to or greater than the potential output value. That is,the top percent risk value can indicate the percentage of the populationof previous access requests that were scored at or above the particularpotential output value.

In some embodiments, the abbreviated scores in the score transformationtable can have integer values and interpolation can be used to determinea floating point number (e.g., having one or more decimal places)between the integer values. The floating point number for theabbreviated scores can improve precision. The access server candetermine the floating point number based on a first trending toppercent value for a first potential output value and a second trendingtop percent value for a second potential output value, where the firstraw score for the first access request is greater than or equal to thefirst potential output value and less than the second potential outputvalue. The floating point value can be determined based on the trendingtop percent value for the raw score and the difference between the firsttrending top percent value and the first trending top percent value. Forexample, the floating point number can be determined using equation (2)below, where F is the floating point value, Tis the trending top percentrisk associated with the raw score for the access request, L is thefirst trending top percent value, and R is the second trending toppercent value:

$\begin{matrix}{F = \frac{L - T}{\frac{( {L - R} )}{100}}} & (2)\end{matrix}$

At step 1104, the access server can determine a first abbreviated scoreusing the score transformation table. The first abbreviated score forthe first access request can be determined using the raw score for thataccess request. In some embodiments, a first potential output value inthe score transformation table can be determined based on the first rawscore being within a threshold of the first potential output value.Accordingly, the first abbreviated score can be determined on the firstpotential output value. These steps may be performed if a particular rawscore is not included in the score transformation table.

In some embodiments, the score transformation table can furtherassociate abbreviated scores with potential output values for eachweekday. For example, the score transformation table can associate afirst potential output value with a first abbreviated score on Mondaysand associate a second potential output value with the first abbreviatedscore on Saturdays. To adapt to different week days, the first accessrequest information in the request message can include a weekdayidentifier indicating the weekday on which the first access request wasmade. Then, the access server can determine the weekday on which thefirst access request was made based on the weekday identifier includedin the first access request information. Accordingly, the firstabbreviated score can be determined based on the weekday.

In some embodiments, different scoring profiles can be established forapplying different score transformation tables. In such embodiments, therequest message can include a scoring profile identifier. The accessserver can determine the score transformation table to be used fromamong a plurality of score transformation tables based on the scoringprofile identifier. The different score transformation tables can eachbe associated with one or more scoring profile identifiers.

In some embodiments, several different scoring models can be used. Forexample, different scoring models can be used depending on the type ofaccess request being assessed. In such embodiments, the request messagecan include a scoring model identifier. Accordingly, the access servercan determine the scoring model to use, from among the plurality ofscoring models, using the scoring model identifier that is included inthe request message.

The access server can also store a set of access rules in the memory.The access rules can be used to determine an access request outcome fora particular access request. The access request outcome can be accept,review, or reject, for example. The access request outcome may be basedon the abbreviated score. The access server can access the memory toobtain the set of access rules.

In some embodiments, the access server can periodically receive updatesto a trending top percent risk table, which can be used to update thescore transformation table. The trending top percent risk table can bereceived from a configuration system. The trending top percent tableincluding a trending top percent value for each potential output valueof the scoring model. After receiving the trending top percent risktable, the access server can update the score transformation table. Toupdate the score transformation table, the access server can determine acorresponding potential output value for the abbreviated score based onthe trending top percent value for the corresponding potential outputvalue being within a threshold of the target top percent value for theabbreviated score. Thus, the score transformation table can dynamicallyadapt to changes in the distribution of raw scores over time.

The configuration system can determine an update schedule for updatingthe trending top percent risk table and sending the updated trending toppercent risk table to the access server. The configuration system canprovide an update scheduling user interface element that enable a userof the configuration system to set the update schedule (e.g., a certainamount of time or days between updates). The configuration system canreceive input from the user indicating the update schedule via theupdate scheduling user interface element and update the trending toppercent risk table, and send it to the access server, according to thereceived input.

At step 1105, the access server can determine a first access requestoutcome for the first access request using the access rules and thefirst abbreviated score. Then, the access server can provide a responsemessage including the first access request outcome for the first accessrequest. Access to the resource can be provided based on the firstaccess request outcome.

The access server can also perform steps 1101-1105 for a second accessrequest (e.g., receive second access request information correspondingto a second access request, determine a second raw score for the secondaccess request, access the score transformation table, determine asecond abbreviated score, and determine a second access request outcomefor the second access request). The access server can further performthese steps for a plurality of access requests received in real timeover a network.

As described, embodiments of the invention may involve implementing oneor more functions, processes, operations or method steps. In someembodiments, the functions, processes, operations or method steps may beimplemented as a result of the execution of a set of instructions orsoftware code by a suitably-programmed computing device, microprocessor,data processor, or the like. The set of instructions or software codemay be stored in a memory or other form of data storage element which isaccessed by the computing device, microprocessor, etc. In otherembodiments, the functions, processes, operations or method steps may beimplemented by firmware or a dedicated processor, integrated circuit,etc.

Any of the software components or functions described in thisapplication may be implemented as software code to be executed by aprocessor using any suitable computer language such as, for example,Java, C++ or Perl using, for example, conventional or object-orientedtechniques. The software code may be stored as a series of instructions,or commands on a computer-readable medium, such as a random accessmemory (RAM), a read-only memory (ROM), a magnetic medium such as ahard-drive or a floppy disk, or an optical medium such as a CD-ROM. Anysuch computer-readable medium may reside on or within a singlecomputational apparatus, and may be present on or within differentcomputational apparatuses within a system or network.

While certain exemplary embodiments have been described in detail andshown in the accompanying drawings, it is to be understood that suchembodiments are merely illustrative of and not intended to berestrictive of the broad invention, and that this invention is not to belimited to the specific arrangements and constructions shown anddescribed, since various other modifications may occur to those withordinary skill in the art.

As used herein, the use of “a,” “an,” or “the” is intended to mean “atleast one,” unless specifically indicated to the contrary. The use of“first,” “second,” “third,” “fourth,” etc., is intended to identify anddifferentiate between elements and does not necessarily imply anordering of the elements unless stated.

What is claimed is:
 1. A method for processing access requests, themethod comprising: providing, by a computer system, a graphical userinterface for configuring a score transformation table, the graphicaluser interface including a first user interface element for inputting afirst target top percent value and a first abbreviated score, the firstuser interface element enabling input of additional target top percentvalues and corresponding abbreviated scores, a set of abbreviated scoresincluding the first abbreviated score and the corresponding abbreviatedscores; determining, by the computer system, a target scoring profiletable including a target top percent value for each abbreviated score inthe set of abbreviated scores based on the first target top percentvalue, the additional target top percent values, and the set ofabbreviated scores; for each abbreviated score in the set of abbreviatedscores: determining, by the computer system, a corresponding potentialoutput value for the abbreviated score based on a trending top percentvalue for the corresponding potential output value being within athreshold of the target top percent value for the abbreviated score; anddetermining, by the computer system, the score transformation tableassociating each abbreviated score in the set of abbreviated scores withthe corresponding potential output value for the abbreviated score, thescore transformation table configured to provide the first abbreviatedscore based on a first raw score for a first access request determinedusing a scoring model, the first abbreviated score being within the setof abbreviated scores, the first raw score being within a set ofpotential output values of the scoring model, the first abbreviatedscore indicating an access request outcome for the first access request.2. The method of claim 1, wherein trending top percent values exist foreach potential output value for each weekday, and wherein thedetermining of a percentage of raw scores that equal the potentialoutput value is performed for each weekday based on raw scores forprevious access requests occurring on that weekday.
 3. The method ofclaim 2, further comprising: filtering, by the computer system using afiltering algorithm, the trending top percent values for each potentialoutput value for each weekday based on historical trending top percentvalues for the potential output value on the weekday.
 4. The method ofclaim 3, further comprising: receiving, by the computer system, a sampledata selection criterion via a sample selection user interface elementof the graphical user interface; sampling, by the computer system,historical access requests based on the sample data selection criterionto obtain a sample; and determining, by the computer system, historicaltrending top percent values using the sample.
 5. The method of claim 1,further comprising: determining, by the computer system, a firstdistribution function using the first target top percent value for thefirst abbreviated score, wherein the first distribution function mapseach abbreviated score in the set of abbreviated scores to a targetpopulation percentage for the abbreviated score; and determining, by thecomputer system, a second distribution function using a second targettop percent value for a second abbreviated score, wherein the targetscoring profile table is determined based on the second distributionfunction.
 6. The method of claim 5, further comprising: determining, bythe computer system, one or more conjugate functions based on the firstdistribution function and the second distribution function; andtransforming, by the computer system, at least one of the firstdistribution function and the second distribution function using the oneor more conjugate functions, wherein the target scoring profile table isdetermined based on the transformation using the one or more conjugatefunctions.
 7. The method of claim 1, wherein the scoring model isgenerated based on validity information corresponding to a plurality ofprevious access requests, the validity information indicating whethereach access request of the plurality of previous access requests isfraudulent or legitimate.
 8. The method of claim 1, wherein the set ofabbreviated scores is at least one order of magnitude smaller than theset of potential output values.
 9. The method of claim 1, furthercomprising: determining, by the computer system, a first distributionfunction using the first target top percent value for the firstabbreviated score, wherein the first distribution function maps eachabbreviated score in the set of abbreviated scores to a targetpopulation percentage for the abbreviated score.
 10. The method of claim9, further comprising: receiving, by the computer system, a first inputto the first user interface element, the first input indicating thefirst target top percent value and the first abbreviated score, whereinthe determining of the first distribution function and the determiningof the target scoring profile table are performed in response to thereceiving of the first input to the first user interface element. 11.The method of claim 9, wherein the graphical user interface furtherincludes a second user interface element for selecting a distributiontype for the first distribution function, the method further comprising:receiving, by the computer system, a second input to the second userinterface element, the second input indicating the distribution type forthe first distribution function, wherein the determining of the firstdistribution function is based on the distribution type, wherein thedistribution type is a normal distribution, a Cauchy distribution, astudent's t-distribution, a logistic distribution, a gamma distribution,or a beta distribution.
 12. The method of claim 9, wherein the graphicaluser interface further includes a third user interface elementpresenting a first graph depicting the first distribution function, thethird user interface element enabling parameters of the firstdistribution function to be modified by interacting with the third userinterface element.
 13. The method of claim 9, wherein the graphical userinterface further includes a fourth user interface element presenting asecond graph based on the target scoring profile table, the fourth userinterface element enabling the target top percent value for eachabbreviated score in the target scoring profile table to be modified byinteracting with the fourth user interface element.
 14. A computersystem, comprising: one or more processors; and a computer readablestorage medium storing a plurality of instructions that, when executedby the one or more processors, cause the one or more processors to:provide a graphical user interface for configuring a scoretransformation table, the graphical user interface including a firstuser interface element for inputting a first target top percent valueand a first abbreviated score, the first user interface element enablinginput of additional target top percent values and correspondingabbreviated scores, a set of abbreviated scores including the firstabbreviated score and the corresponding abbreviated scores; determine ascoring profile table including a target top percent value for eachabbreviated score in the set of abbreviated scores based on the firsttarget top percent value, the additional target top percent values, andthe set of abbreviated scores; for each abbreviated score in the set ofabbreviated scores: determine a corresponding potential output value forthe abbreviated score based on a trending top percent value for thecorresponding potential output value being within a threshold of thetarget top percent value for the abbreviated score; and determine, bythe computer system, the score transformation table associating eachabbreviated score in the set of abbreviated scores with thecorresponding potential output value for the abbreviated score, thescore transformation table configured to provide the first abbreviatedscore based on a first raw score for a first access request determinedusing a scoring model, the first abbreviated score being within the setof abbreviated scores, the first raw score being within a set ofpotential output values of the scoring model, the first abbreviatedscore indicating an access request outcome for the first access request.15. The computer system of claim 14, wherein trending top percent valuesexist for each potential output value for each weekday, and wherein thedetermining of a percentage of raw scores that equal the potentialoutput value is performed for each weekday based on raw scores forprevious access requests occurring on that weekday, and wherein theplurality of instructions further cause the one or more processors to:filter, using a filtering algorithm, the trending top percent values foreach potential output value for each weekday based on historicaltrending top percent values for the potential output value on theweekday.
 16. The computer system of claim 14, wherein the plurality ofinstructions further cause the one or more processors to: determine afirst distribution function using the first target top percent value forthe first abbreviated score, wherein the first distribution functionmaps each abbreviated score in the set of abbreviated scores to a targetpopulation percentage for the abbreviated score; determine a seconddistribution function using a second target top percent value for asecond abbreviated score, wherein the scoring profile table isdetermined based on the second distribution function; determine one ormore conjugate functions based on the first distribution function andthe second distribution function; and transform at least one of thefirst distribution function and the second distribution function usingthe one or more conjugate functions, wherein the scoring profile tableis determined based on the transformation using the one or moreconjugate functions.
 17. The computer system of claim 14, wherein theplurality of instructions further cause the one or more processors to:determining, by the computer system, a first distribution function usingthe first target top percent value for the first abbreviated score,wherein the first distribution function maps each abbreviated score inthe set of abbreviated scores to a target population percentage for theabbreviated score.
 18. The computer system of claim 17, wherein theplurality of instructions further cause the one or more processors to:receive a first input to the first user interface element, the firstinput indicating the first target top percent value and the firstabbreviated score, wherein the determining of the first distributionfunction and the determining of the scoring profile table are performedin response to the first input to the first user interface element. 19.The computer system of claim 17, wherein the graphical user interfacefurther includes a second user interface element for selecting adistribution type for the first distribution function, and wherein theplurality of instructions further cause the one or more processors to:receive a second input to the second user interface element, the secondinput indicating the distribution type for the first distributionfunction, wherein the determining of the first distribution function isbased on the distribution type.
 20. The computer system of claim 17,wherein the graphical user interface further includes a third userinterface element presenting a first graph depicting the firstdistribution function, the third user interface element enablingparameters of the first distribution function to be modified byinteracting with the third user interface element, and wherein thegraphical user interface further includes a fourth user interfaceelement presenting a second graph based on the scoring profile table,the fourth user interface element enabling the target top percent valuefor each abbreviated score in the scoring profile table to be modifiedby interacting with the fourth user interface element.